Merge branch '1.9.x' into dev

Conflicts:
	src/Orchard.Web/Modules/Orchard.DynamicForms/Web.config
	src/Orchard.Web/Modules/Orchard.ImageEditor/Web.config
	src/Orchard.Web/Modules/Orchard.Layouts/Orchard.Layouts.csproj
	src/Orchard/Localization/Text.cs

.gitignore

@@ -189,3 +189,4 @@ src/Orchard.Web/Modules/Orchard.DynamicForms/node_modules
 
 #enable all /lib artifacts
 !lib/*/*.*
+*/.vs/*

src/Orchard.Tests/Localization/TextTests.cs

@@ -0,0 +1,46 @@
+using Autofac;
+using Moq;
+using NUnit.Framework;
+using Orchard.Localization;
+using Orchard.Localization.Services;
+using Orchard.Mvc;
+using Orchard.Tests.Stubs;
+using System.Web;
+
+namespace Orchard.Tests.Localization {
+    [TestFixture]
+    public class TextTests {
+        private IContainer _container;
+        private IText _text;
+
+        [SetUp]
+        public void Init() {
+            var mockLocalizedManager = new Mock<ILocalizedStringManager>();
+            mockLocalizedManager
+                .Setup(x => x.GetLocalizedString(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>()))
+                .Returns("foo {0}");
+
+            var builder = new ContainerBuilder();
+            builder.RegisterInstance(new StubCultureSelector("fr-CA")).As<ICultureSelector>();
+            builder.RegisterInstance(new StubWorkContext()).As<WorkContext>();
+            builder.RegisterType<StubWorkContextAccessor>().As<IWorkContextAccessor>();
+            builder.RegisterInstance(mockLocalizedManager.Object);
+            builder.RegisterType<Orchard.Localization.Text>().As<IText>().WithParameter(new NamedParameter("scope", "scope"));
+            _container = builder.Build();
+            _text = _container.Resolve<IText>();
+        }
+
+        [Test]
+        public void TextHtmlEncodeAllArguments() {
+            Assert.That(_text.Get("foo {0}", "bar").Text, Is.EqualTo("foo bar"));
+            Assert.That(_text.Get("foo {0}", "<bar>").Text, Is.EqualTo("foo &lt;bar&gt;"));
+        }
+
+        [Test]
+        public void TextDoesEncodeHtmlEncodedArguments()
+        {
+            Assert.That(_text.Get("foo {0}", new HtmlString("bar")).Text, Is.EqualTo("foo bar"));
+            Assert.That(_text.Get("foo {0}", new HtmlString("<bar>")).Text, Is.EqualTo("foo <bar>"));
+        }
+    }
+}

src/Orchard.Tests/Orchard.Framework.Tests.csproj

@@ -259,6 +259,7 @@
     <Compile Include="FileSystems\Dependencies\AssemblyProbingFolderTests.cs" />
     <Compile Include="FileSystems\Dependencies\DependenciesFolderTests.cs" />
     <Compile Include="FileSystems\VirtualPath\DefaultVirtualPathProviderTests.cs" />
+    <Compile Include="Localization\TextTests.cs" />
     <Compile Include="Localization\CurrentCultureWorkContextTests.cs" />
     <Compile Include="Localization\CultureManagerTests.cs" />
     <Compile Include="Localization\DateTimePartsTests.cs" />

src/Orchard.Tests/Utility/Extensions/StringExtensionsTests.cs

@@ -282,5 +282,21 @@ namespace Orchard.Tests.Utility.Extensions {
             Assert.That("abc".Translate("d".ToCharArray(), "d".ToCharArray()), Is.StringMatching("abc"));
             Assert.That("abc".Translate("abc".ToCharArray(), "def".ToCharArray()), Is.StringMatching("def"));
         }
+
+        [Test]
+        public void ShouldEncodeToBase64() {
+            Assert.That("abc".ToBase64(), Is.EqualTo("YWJj"));
+        }
+
+        [Test]
+        public void ShouldDecodeFromBase64() {
+            Assert.That("YWJj".FromBase64(), Is.EqualTo("abc"));
+        }
+
+        [Test]
+        public void ShouldRoundtripBase64() {
+            Assert.That("abc".ToBase64().FromBase64(), Is.EqualTo("abc"));
+            Assert.That("YWJj".FromBase64().ToBase64(), Is.EqualTo("YWJj"));
+        }
     }
 }

src/Orchard.WarmupStarter/Orchard.WarmupStarter.csproj

@@ -24,6 +24,7 @@
     <WarningLevel>4</WarningLevel>
     <Prefer32Bit>false</Prefer32Bit>
     <UseVSHostingProcess>false</UseVSHostingProcess>
+    <CodeAnalysisRuleSet>..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
     <DebugType>pdbonly</DebugType>

src/Orchard.Web/Core/Shapes/Views/Message.cshtml

@@ -1 +1,6 @@
-<div class="message message-@Model.Type">@Html.Raw(Html.Encode(Model.Message).Replace("\n", "<br />"))</div>
+@* 
+    Model.Message can either be:
+    - an IHtmlString and won't be re-encoded
+    - a string and will be encoded
+*@
+<div class="message message-@Model.Type">@Html.Raw(Html.Encode(Model.Message).Replace("\n", "<br />"))</div>

src/Orchard.Web/Core/Shapes/Views/User.cshtml

@@ -3,7 +3,7 @@
 <div class="user-display">
     @if (WorkContext.CurrentUser != null) {
         <span class="user-actions welcome">
-            @T("Welcome, <strong>{0}</strong>!", "<a href=\"" + @Url.Action("ChangePassword", new { Controller = "Account", Area = "Orchard.Users" }) + "\">" + @Html.ItemDisplayText(WorkContext.CurrentUser) + "</a>")
+            @T("Welcome, <strong>{0}</strong>!", Html.Raw("<a href=\"" + @Url.Action("ChangePassword", new { Controller = "Account", Area = "Orchard.Users" }) + "\">" + Html.ItemDisplayText(WorkContext.CurrentUser) + "</a>"))
         </span>
         <span class="user-actions">
             @Html.ActionLink(T("Sign Out").ToString(), "LogOff", new { Controller = "Account", Area = "Orchard.Users", ReturnUrl = Context.Request.RawUrl }, new { rel = "nofollow" })

src/Orchard.Web/Modules/Orchard.Alias/Orchard.Alias.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.AntiSpam/Orchard.AntiSpam.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.AuditTrail/Orchard.AuditTrail.csproj

@@ -24,6 +24,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -33,7 +34,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.AuditTrail/Services/Models/Filters.cs

@@ -1,4 +1,5 @@
-using System.Collections.Generic;
+using System;
+using System.Collections.Generic;
 using System.Collections.Specialized;
 using Orchard.ContentManagement;
 
@@ -15,7 +16,9 @@ namespace Orchard.AuditTrail.Services.Models {
             var filters = new Filters(updateModel);
 
             foreach (string nameValue in nameValues) {
-                filters.Add(nameValue, nameValues[nameValue]);
+                if (!String.IsNullOrEmpty(nameValue)) {
+                    filters.Add(nameValue, nameValues[nameValue]);
+                }
             }
 
             return filters;

src/Orchard.Web/Modules/Orchard.AuditTrail/Views/RecycleBin/Index.cshtml

@@ -48,7 +48,8 @@
                                 var isSelected = Model.SelectedContentItems.Where(x => x.Id == contentItem.Id && x.Selected).Select(x => x.Id).Any();
                                 var commonPart = contentItem.As<CommonPart>();
                                 var removedText = commonPart != null ? dateLocalizationServices.ConvertToLocalizedString(commonPart.VersionModifiedUtc) : T("-").Text;
-                                var contentDisplayText = Html.ItemDisplayText(contentItem).ToString();
+                                var contentDisplayTextHtmlString = Html.ItemDisplayText(contentItem);
+                                var contentDisplayText = contentDisplayTextHtmlString != null ? contentDisplayTextHtmlString.ToString() : contentItem.ContentType;
                                 var contentDisplayUrl = Url.Action("Detail", "Content", new {id = contentItem.Id, version = contentItem.Version, area = "Orchard.AuditTrail"});
                                 <tr>
                                     <td>

src/Orchard.Web/Modules/Orchard.Autoroute/Orchard.Autoroute.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.Azure.MediaServices/Orchard.Azure.MediaServices.csproj

@@ -24,6 +24,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -33,7 +34,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.Azure/Orchard.Azure.csproj

@@ -24,6 +24,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -33,7 +34,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.Caching/Orchard.Caching.csproj

@@ -24,6 +24,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -33,7 +34,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.CodeGeneration/CodeGenerationTemplates/ModuleCsProj.txt

@@ -33,7 +33,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.CodeGeneration/CodeGenerationTemplates/ModuleTestsCsProj.txt

@@ -20,7 +20,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.ContentPermissions/Orchard.ContentPermissions.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.ContentPicker/Orchard.ContentPicker.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.CustomForms/Orchard.CustomForms.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.CustomForms/Views/Item/Create.cshtml

@@ -8,6 +8,8 @@
 
     // remove default Save/Publish buttons
     Model.Zones["Sidebar"].Items.Clear();
+
+    var submitButtonText = String.IsNullOrEmpty(Model.ContentItem.CustomFormPart.SubmitButtonText) ? T("Submit").Text : Model.ContentItem.CustomFormPart.SubmitButtonText;
 }
 
 @Display(New.Parts_Title().Title(Html.ItemDisplayText(customForm)))
@@ -18,7 +20,7 @@
     @Display(Model)
 
     <fieldset class="submit-button">
-        <button type="submit" name="submit.Save" value="submit.Save">@Model.ContentItem.CustomFormPart.SubmitButtonText</button>
+        <button type="submit" name="submit.Save" value="submit.Save">@submitButtonText</button>
     </fieldset>
 }
 

src/Orchard.Web/Modules/Orchard.DesignerTools/Orchard.DesignerTools.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.DynamicForms/Orchard.DynamicForms.csproj

@@ -34,7 +34,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.DynamicForms/Web.config

@@ -33,6 +33,7 @@
                 <add assembly="System.Web.WebPages, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/>
                 <add assembly="System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
                 <add assembly="System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
+                <add assembly="Orchard.Layouts"/>
                 <add assembly="Orchard.Framework"/>
                 <add assembly="Orchard.Core"/>
             </assemblies>

src/Orchard.Web/Modules/Orchard.Fields/Orchard.Fields.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.Forms/Orchard.Forms.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.ImageEditor/Orchard.ImageEditor.csproj

@@ -24,6 +24,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -33,7 +34,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.ImageEditor/Web.config

@@ -31,6 +31,7 @@
                 <add assembly="System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/>
                 <add assembly="System.Web.Mvc, Version=5.2.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/>
                 <add assembly="System.Web.WebPages, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/>
+                <add assembly="Orchard.MediaLibrary"/>
                 <add assembly="Orchard.Framework"/>
                 <add assembly="Orchard.Core"/>
             </assemblies>

src/Orchard.Web/Modules/Orchard.Indexing/Orchard.Indexing.csproj

@@ -25,6 +25,7 @@
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.JobsQueue/Orchard.JobsQueue.csproj

@@ -26,6 +26,7 @@
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -36,6 +37,7 @@
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
     <Prefer32Bit>false</Prefer32Bit>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
     <DebugType>pdbonly</DebugType>

src/Orchard.Web/Modules/Orchard.Layouts/Drivers/BreakElementDriver.cs

@@ -0,0 +1,7 @@
+using Orchard.Layouts.Elements;
+using Orchard.Layouts.Framework.Drivers;
+
+namespace Orchard.Layouts.Drivers {
+    public class BreakElementDriver : ElementDriver<Break> {
+    }
+}

src/Orchard.Web/Modules/Orchard.Layouts/Drivers/LayoutPartDriver.cs

@@ -1,4 +1,5 @@
 using System;
+using System.Collections.Generic;
 using System.Linq;
 using Orchard.ContentManagement;
 using Orchard.ContentManagement.Drivers;
@@ -12,6 +13,7 @@ using Orchard.Layouts.Models;
 using Orchard.Layouts.Services;
 using Orchard.Layouts.Settings;
 using Orchard.Layouts.ViewModels;
+using Orchard.Logging;
 
 namespace Orchard.Layouts.Drivers {
     public class LayoutPartDriver : ContentPartDriver<LayoutPart> {
@@ -23,6 +25,7 @@ namespace Orchard.Layouts.Drivers {
         private readonly IShapeDisplay _shapeDisplay;
         private readonly ILayoutModelMapper _mapper;
         private readonly ILayoutEditorFactory _layoutEditorFactory;
+        private readonly HashSet<string> _stack;
 
         public LayoutPartDriver(
             ILayoutSerializer serializer,
@@ -42,22 +45,45 @@ namespace Orchard.Layouts.Drivers {
             _shapeDisplay = shapeDisplay;
             _mapper = mapper;
             _layoutEditorFactory = layoutEditorFactory;
+            _stack = new HashSet<string>();
+
+            Logger = NullLogger.Instance;
         }
 
+        public ILogger Logger { get; set; }
+
         protected override DriverResult Display(LayoutPart part, string displayType, dynamic shapeHelper) {
             return Combined(
                 ContentShape("Parts_Layout", () => {
+                    if (DetectRecursion(part, "Parts_Layout"))
+                        return shapeHelper.Parts_Layout_Recursive();
+
                     var elements = _layoutManager.LoadElements(part);
                     var layoutRoot = _elementDisplay.DisplayElements(elements, part, displayType: displayType);
                     return shapeHelper.Parts_Layout(LayoutRoot: layoutRoot);
                 }),
                 ContentShape("Parts_Layout_Summary", () => {
+                    if (DetectRecursion(part, "Parts_Layout_Summary"))
+                        return shapeHelper.Parts_Layout_Summary_Recursive();
+
                     var layoutShape = _contentPartDisplay.Value.BuildDisplay(part);
                     var layoutHtml = _shapeDisplay.Display(layoutShape);
                     return shapeHelper.Parts_Layout_Summary(LayoutHtml: layoutHtml);
                 }));
         }
 
+        private bool DetectRecursion(LayoutPart part, string shapeName) {
+            var key = String.Format("{0}:{1}", shapeName, part.Id);
+
+            if (_stack.Contains(key)) {
+                Logger.Debug(String.Format("Detected recursive layout rendering of layout with ID = {0} and shape = {1}", part.Id, shapeName));
+                return true;
+            }
+
+            _stack.Add(key);
+            return false;
+        }
+
         protected override DriverResult Editor(LayoutPart part, dynamic shapeHelper) {
             return Editor(part, null, shapeHelper);
         }
@@ -91,7 +117,7 @@ namespace Orchard.Layouts.Drivers {
                     part.LayoutData = _serializer.Serialize(elementInstances);
                     part.TemplateId = viewModel.LayoutEditor.TemplateId;
                     part.SessionKey = viewModel.LayoutEditor.SessionKey;
-                    viewModel.LayoutEditor.Data = _mapper.ToEditorModel(part.LayoutData, new DescribeElementsContext {Content = part}).ToJson();
+                    viewModel.LayoutEditor.Data = _mapper.ToEditorModel(part.LayoutData, new DescribeElementsContext { Content = part }).ToJson();
                 }
 
                 return shapeHelper.EditorTemplate(TemplateName: "Parts.Layout", Model: viewModel, Prefix: Prefix);

src/Orchard.Web/Modules/Orchard.Layouts/Drivers/ProjectionElementDriver.cs

@@ -288,7 +288,7 @@ namespace Orchard.Layouts.Drivers {
 
         protected override void OnExporting(Projection element, ExportElementContext context) {
             var query = element.QueryId != null ? _contentManager.Get<QueryPart>(element.QueryId.Value) : default(QueryPart);
-            var layout = element.LayoutId != null ? _layoutRepository.Get(element.LayoutId.Value) : default(LayoutRecord);
+            var layout = query != null && element.LayoutId != null ? _layoutRepository.Get(element.LayoutId.Value) : default(LayoutRecord);
             var queryIdentity = query != null ? _contentManager.GetItemMetadata(query).Identity.ToString() : default(string);
             var layoutIndex = layout != null ? query.Layouts.IndexOf(layout) : default(int?);
 

src/Orchard.Web/Modules/Orchard.Layouts/Elements/Break.cs

@@ -0,0 +1,11 @@
+namespace Orchard.Layouts.Elements {
+    public class Break : ContentElement {
+        public override string ToolboxIcon {
+            get { return "\uf068"; }
+        }
+
+        public override bool HasEditor {
+            get { return false; }
+        }
+    }
+}

src/Orchard.Web/Modules/Orchard.Layouts/Orchard.Layouts.csproj

@@ -34,7 +34,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
@@ -321,12 +321,14 @@
     <Compile Include="Drivers\MenuElementDriver.cs" />
     <Compile Include="Drivers\NotificationsElementDriver.cs" />
     <Compile Include="Drivers\ShapeElementDriver.cs" />
+    <Compile Include="Drivers\BreakElementDriver.cs" />
     <Compile Include="Elements\Breadcrumbs.cs" />
     <Compile Include="Elements\Canvas.cs" />
     <Compile Include="Elements\ContentElement.cs" />
     <Compile Include="Elements\Menu.cs" />
     <Compile Include="Elements\Notifications.cs" />
     <Compile Include="Elements\Shape.cs" />
+    <Compile Include="Elements\Break.cs" />
     <Compile Include="Elements\UIElement.cs" />
     <Compile Include="Filters\TokensFilter.cs" />
     <Compile Include="Framework\Display\ElementDisplayedContext.cs" />
@@ -549,9 +551,12 @@
     <Content Include="Styles\Lib\FontAwesome\Fonts\fontawesome-webfont.woff2" />
   </ItemGroup>
   <ItemGroup>
+    <Content Include="Views\Elements\Break.cshtml" />
     <Content Include="Styles\LayoutEditor\Menu.less" />
   </ItemGroup>
   <ItemGroup>
+    <Content Include="Views\Parts.Layout.Recursive.cshtml" />
+    <Content Include="Views\Parts.Layout.Summary.Recursive.cshtml" />
     <Content Include="Views\EditorTemplates\Elements.Breadcrumbs.cshtml" />
     <Content Include="Views\EditorTemplates\Elements.Menu.cshtml" />
   </ItemGroup>

src/Orchard.Web/Modules/Orchard.Layouts/Views/Elements/Break.cshtml

@@ -0,0 +1,5 @@
+@using Orchard.Layouts.Helpers
+@{
+    var tagBuilder = TagBuilderExtensions.CreateElementTagBuilder(Model, "hr");
+}
+@tagBuilder.ToHtmlString()

src/Orchard.Web/Modules/Orchard.Layouts/Views/Parts.Layout.Recursive.cshtml

@@ -0,0 +1 @@
+<!--Stopped recursive layout rendering.-->

src/Orchard.Web/Modules/Orchard.Layouts/Views/Parts.Layout.Summary.Recursive.cshtml

@@ -0,0 +1 @@
+<!--Stopped recursive layout rendering.-->

src/Orchard.Web/Modules/Orchard.Localization/Orchard.Localization.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -35,6 +36,7 @@
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
     <Prefer32Bit>false</Prefer32Bit>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
     <DebugType>pdbonly</DebugType>

src/Orchard.Web/Modules/Orchard.MediaLibrary/Orchard.MediaLibrary.csproj

@@ -24,6 +24,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -33,7 +34,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.MediaLibrary/Views/Parts/Media.SummaryAdmin.cshtml

@@ -32,5 +32,5 @@
 }
 <div class="publication-status">
     <em>@T("Status:")</em>
-    <span>@T("{0}", mediaPart.ContentItem.VersionRecord.Published ? "Published" : "Draft")</span>
+    <span>@T(mediaPart.ContentItem.VersionRecord.Published ? "Published" : "Draft")</span>
 </div>

src/Orchard.Web/Modules/Orchard.MediaPicker/Orchard.MediaPicker.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.MediaProcessing/Orchard.MediaProcessing.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.MessageBus/Orchard.MessageBus.csproj

@@ -24,6 +24,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -33,7 +34,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.Modules/Views/Admin/Features.cshtml

@@ -89,7 +89,7 @@
                     featureClassName += " missingDependencies";
                 }
 
-                <li class="@featureClassName" id="@featureId" title="@T("{0} is {1}", Html.AttributeEncode(featureName), featureState)">
+                <li class="@featureClassName" id="@featureId" title="@T(feature.IsEnabled ? "{0} is enabled" : "{0} is disabled", Html.AttributeEncode(featureName))">
                     <div class="summary">
                         <div class="properties">
                             <h3>

src/Orchard.Web/Modules/Orchard.OutputCache/Orchard.OutputCache.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.Pages/Orchard.Pages.csproj

@@ -25,6 +25,7 @@
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
     <TargetFrameworkProfile />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -35,6 +36,7 @@
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
     <Prefer32Bit>false</Prefer32Bit>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
     <DebugType>pdbonly</DebugType>

src/Orchard.Web/Modules/Orchard.Projections/FilterEditors/Forms/DateTimeFilterForm.cs

@@ -249,21 +249,21 @@ namespace Orchard.Projections.FilterEditors.Forms {
 
             switch (op) {
                 case DateTimeOperator.LessThan:
-                    return T("{0} is less than {1}{2}", fieldName, value, T(valueUnit).Text);
+                    return T("{0} is less than {1}{2}", fieldName, value, T(valueUnit));
                 case DateTimeOperator.LessThanEquals:
-                    return T("{0} is less or equal than {1}{2}", fieldName, value, T(valueUnit).Text);
+                    return T("{0} is less or equal than {1}{2}", fieldName, value, T(valueUnit));
                 case DateTimeOperator.Equals:
-                    return T("{0} equals {1}{2}", fieldName, value, T(valueUnit).Text);
+                    return T("{0} equals {1}{2}", fieldName, value, T(valueUnit));
                 case DateTimeOperator.NotEquals:
-                    return T("{0} is not equal to {1}{2}", fieldName, value, T(valueUnit).Text);
+                    return T("{0} is not equal to {1}{2}", fieldName, value, T(valueUnit));
                 case DateTimeOperator.GreaterThan:
-                    return T("{0} is greater than {1}{2}", fieldName, value, T(valueUnit).Text);
+                    return T("{0} is greater than {1}{2}", fieldName, value, T(valueUnit));
                 case DateTimeOperator.GreaterThanEquals:
-                    return T("{0} is greater or equal than {1}{2}", fieldName, value, T(valueUnit).Text);
+                    return T("{0} is greater or equal than {1}{2}", fieldName, value, T(valueUnit));
                 case DateTimeOperator.Between:
-                    return T("{0} is between {1}{2} and {3}{4}", fieldName, min, T(minUnit).Text, max, T(maxUnit).Text);
+                    return T("{0} is between {1}{2} and {3}{4}", fieldName, min, T(minUnit), max, T(maxUnit));
                 case DateTimeOperator.NotBetween:
-                    return T("{0} is not between {1}{2} and {3}{4}", fieldName, min, T(minUnit).Text, max, T(maxUnit).Text);
+                    return T("{0} is not between {1}{2} and {3}{4}", fieldName, min, T(minUnit), max, T(maxUnit));
             }
 
             // should never be hit, but fail safe

src/Orchard.Web/Modules/Orchard.Projections/Orchard.Projections.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.Projections/Tests/Orchard.Projections.Tests.csproj

@@ -23,6 +23,7 @@
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
     <Prefer32Bit>false</Prefer32Bit>
+    <CodeAnalysisRuleSet>..\..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
     <DebugType>pdbonly</DebugType>

src/Orchard.Web/Modules/Orchard.Projections/Views/Admin/Edit.cshtml

@@ -1,9 +1,8 @@
 @model AdminEditViewModel
-@using Orchard.Projections.Models;
 @using Orchard.Projections.ViewModels;
 
 @{
-    Layout.Title = T("Edit Query - {0}", Model.Name).Text;
+    Layout.Title = T("Edit Query - {0}", Model.Name);
     Style.Include("admin-projections.css");
 }
 

src/Orchard.Web/Modules/Orchard.Redis/Orchard.Redis.csproj

@@ -24,6 +24,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -33,7 +34,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.Rules/Orchard.Rules.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.Scripting.CSharp/Orchard.Scripting.CSharp.csproj

@@ -24,6 +24,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -33,7 +34,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.SecureSocketsLayer/Orchard.SecureSocketsLayer.csproj

@@ -24,6 +24,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -33,7 +34,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
@@ -91,6 +92,7 @@
     <Compile Include="Filters\SecureSocketsLayersFilter.cs" />
     <Compile Include="Handlers\SslSettingsPartHandler.cs" />
     <Compile Include="Models\SslSettingsPart.cs" />
+    <Compile Include="Services\SecureSocketsLayerSettingsProvider.cs" />
     <Compile Include="Services\ISecureSocketsLayerService.cs" />
     <Compile Include="Services\SecureSocketsLayerService.cs" />
   </ItemGroup>

src/Orchard.Web/Modules/Orchard.SecureSocketsLayer/Services/SecureSocketsLayerSettingsProvider.cs

@@ -0,0 +1,17 @@
+using Orchard.Environment.Extensions;
+using Orchard.Security;
+
+namespace Orchard.SecureSocketsLayer.Services {
+    [OrchardSuppressDependency("Orchard.Security.Providers.DefaultSslSettingsProvider")]
+    public class SecureSocketsLayerSettingsProvider : ISslSettingsProvider {
+        private readonly ISecureSocketsLayerService _secureSocketsLayerService;
+
+        public SecureSocketsLayerSettingsProvider(ISecureSocketsLayerService secureSocketsLayerService) {
+            _secureSocketsLayerService = secureSocketsLayerService;
+        }
+
+        public bool GetRequiresSSL() {
+            return _secureSocketsLayerService.GetSettings().Enabled;
+        }
+    }
+}

src/Orchard.Web/Modules/Orchard.TaskLease/Orchard.TaskLease.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.Taxonomies/Orchard.Taxonomies.csproj

@@ -26,6 +26,7 @@
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
     <TargetFrameworkProfile />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -36,6 +37,7 @@
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
     <Prefer32Bit>false</Prefer32Bit>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
     <DebugType>pdbonly</DebugType>

src/Orchard.Web/Modules/Orchard.Templates/Orchard.Templates.csproj

@@ -24,6 +24,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -33,7 +34,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.Tokens/Orchard.Tokens.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.Tokens/Tests/Orchard.Tokens.Tests.csproj

@@ -23,6 +23,7 @@
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
     <Prefer32Bit>false</Prefer32Bit>
+    <CodeAnalysisRuleSet>..\..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
     <DebugType>pdbonly</DebugType>

src/Orchard.Web/Modules/Orchard.Warmup/Orchard.Warmup.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.Workflows/Orchard.Workflows.csproj

@@ -24,6 +24,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -33,7 +34,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Orchard.Workflows/Views/Activity-Timer.cshtml

@@ -2,11 +2,11 @@
 
 @{
     string name = Model.Name;
-    string title = null;
+    IHtmlString title = null;
     if (Model.State != null && HasText(Model.State.Unity)) {
         string amount = Model.State.Amount;
         string unity = Model.State.Unity;
-        title = T("{0} {1} after", amount, T(unity).Text).Text;
+        title = T("{0} {1} after", amount, T(unity));
     }
 }
 

src/Orchard.Web/Modules/SysCache/SysCache.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/TinyMce/TinyMce.csproj

@@ -25,6 +25,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -34,7 +35,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Modules/Upgrade/Upgrade.csproj

@@ -24,6 +24,7 @@
     <IISExpressAnonymousAuthentication />
     <IISExpressWindowsAuthentication />
     <IISExpressUseClassicPipelineMode />
+    <UseGlobalApplicationHostFile />
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -33,7 +34,7 @@
     <DefineConstants>DEBUG;TRACE</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
-    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisRuleSet>..\..\..\OrchardBasicCorrectness.ruleset</CodeAnalysisRuleSet>
     <Prefer32Bit>false</Prefer32Bit>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">

src/Orchard.Web/Themes/TheAdmin/Views/Title.cshtml

@@ -1 +1 @@
-<h1 id="page-title">@Model.Title.ToString()</h1>
+<h1 id="page-title">@Model.Title</h1>

src/Orchard/Localization/LocalizedString.cs

@@ -2,6 +2,10 @@
 using System.Web;
 
 namespace Orchard.Localization {
+
+    /// <summary>
+    /// An HTML-encoded localized string
+    /// </summary>
     public class LocalizedString : MarshalByRefObject, IHtmlString {
         private readonly string _localized;
         private readonly string _scope;
@@ -30,6 +34,9 @@ namespace Orchard.Localization {
             get { return _scope; }
         }
 
+        /// <summary>
+        /// The HTML-Encoded original text
+        /// </summary>
         public string TextHint {
             get { return _textHint; }
         }
@@ -38,10 +45,16 @@ namespace Orchard.Localization {
             get { return _args; }
         }
 
+        /// <summary>
+        /// The HTML-encoded localized text
+        /// </summary>
         public string Text {
             get { return _localized; }
         }
 
+        /// <summary>
+        /// The HTML-encoded localized text
+        /// </summary>
         public override string ToString() {
             return _localized;
         }

src/Orchard/Localization/Localizer.cs

@@ -2,6 +2,13 @@ using System.Linq;
 using Orchard.Localization;
 
 namespace Orchard.Localization {
+
+    /// <summary>
+    /// Localizes some text based on the current Work Context culture
+    /// </summary>
+    /// <param name="text">The text format to localize</param>
+    /// <param name="args">The arguments used in the text format. The arguments are HTML-encoded if they don't implement <see cref="System.Web.IHtmlString"/>.</param>
+    /// <returns>An HTML-encoded localized string</returns>
     public delegate LocalizedString Localizer(string text, params object[] args);
 }
 

src/Orchard/Localization/Text.cs

@@ -2,6 +2,8 @@ using System;
 using System.Globalization;
 using Orchard.Localization.Services;
 using Orchard.Logging;
+using System.Web;
+using System.Linq;
 
 namespace Orchard.Localization {
     public class Text : IText {
@@ -27,9 +29,15 @@ namespace Orchard.Localization {
                 var currentCulture = workContext.CurrentCulture;
                 var localizedFormat = _localizedStringManager.GetLocalizedString(_scope, textHint, currentCulture);
 
+                // localization arguments are HTML-encoded unless they implement IHtmlString
+
                 return args.Length == 0
                 ? new LocalizedString(localizedFormat, _scope, textHint, args)
-                : new LocalizedString(string.Format(GetFormatProvider(currentCulture), localizedFormat, args), _scope, textHint, args);
+				: new LocalizedString(
+                    String.Format(GetFormatProvider(currentCulture), localizedFormat, args.Select(Encode).ToArray()), 
+                    _scope, 
+                    textHint, 
+                    args);
             }
 
             return new LocalizedString(textHint, _scope, textHint, args);
@@ -43,5 +51,14 @@ namespace Orchard.Localization {
                 return null;
             }
         }
+
+        static object Encode(object arg)
+        {
+            if (arg is IFormattable || arg is IHtmlString) {
+                return arg;
+            }
+
+            return HttpUtility.HtmlEncode(arg);
+        }
     }
 }

src/Orchard/Orchard.Framework.csproj

@@ -149,6 +149,8 @@
     <Reference Include="System.Xml.Linq" />
   </ItemGroup>
   <ItemGroup>
+    <Compile Include="Security\ISslSettingsProvider.cs" />
+    <Compile Include="Security\Providers\DefaultSslSettingsProvider.cs" />
     <Compile Include="StaticHttpContextScope.cs" />
     <Compile Include="StaticHttpContextScopeFactory.cs" />
     <Compile Include="Caching\DefaultCacheContextAccessor.cs" />

src/Orchard/Security/ISslSettingsProvider.cs

@@ -0,0 +1,11 @@
+using System;
+
+namespace Orchard.Security {
+    public interface ISslSettingsProvider : IDependency {
+
+        /// <summary>
+        /// Gets whether authentication cookies should only be transmitted over SSL or not.
+        /// </summary>
+        bool GetRequiresSSL();
+    }
+}

src/Orchard/Security/Providers/DefaultSslSettingsProvider.cs

@@ -0,0 +1,15 @@
+using System.Web.Security;
+
+namespace Orchard.Security.Providers {
+    public class DefaultSslSettingsProvider : ISslSettingsProvider {
+        public bool RequireSSL { get; set; }
+
+        public DefaultSslSettingsProvider() {
+            RequireSSL = FormsAuthentication.RequireSSL;
+        }
+
+        public bool GetRequiresSSL() {
+            return RequireSSL;
+        }
+    }
+}

src/Orchard/Security/Providers/FormsAuthenticationService.cs

@@ -3,25 +3,34 @@ using System.Web;
 using System.Web.Security;
 using Orchard.Environment.Configuration;
 using Orchard.Logging;
-using Orchard.ContentManagement;
 using Orchard.Mvc;
 using Orchard.Mvc.Extensions;
 using Orchard.Services;
+using Orchard.Utility.Extensions;
 
 namespace Orchard.Security.Providers {
     public class FormsAuthenticationService : IAuthenticationService {
+        private const int _version = 3;
+
         private readonly ShellSettings _settings;
         private readonly IClock _clock;
-        private readonly IContentManager _contentManager;
+        private readonly IMembershipService _membershipService;
         private readonly IHttpContextAccessor _httpContextAccessor;
+        private readonly ISslSettingsProvider _sslSettingsProvider;
         private IUser _signedInUser;
         private bool _isAuthenticated;
 
-        public FormsAuthenticationService(ShellSettings settings, IClock clock, IContentManager contentManager, IHttpContextAccessor httpContextAccessor) {
+        public FormsAuthenticationService(
+            ShellSettings settings, 
+            IClock clock, 
+            IMembershipService membershipService, 
+            IHttpContextAccessor httpContextAccessor,
+            ISslSettingsProvider sslSettingsProvider) {
             _settings = settings;
             _clock = clock;
-            _contentManager = contentManager;
+            _membershipService = membershipService;
             _httpContextAccessor = httpContextAccessor;
+            _sslSettingsProvider = sslSettingsProvider;
 
             Logger = NullLogger.Instance;
             
@@ -35,11 +44,12 @@ namespace Orchard.Security.Providers {
         public void SignIn(IUser user, bool createPersistentCookie) {
             var now = _clock.UtcNow.ToLocalTime();
             
-            // the cookie user data is {userId};{tenant}
+            // the cookie user data is {userName.Base64};{tenant}
-            var userData = String.Concat(Convert.ToString(user.Id), ";", _settings.Name); 
+            // the username is encoded to base64 to prevent collisions with the ';' seprarator
+            var userData = String.Concat(Convert.ToString(user.UserName).ToBase64(), ";", _settings.Name); 
 
             var ticket = new FormsAuthenticationTicket(
-                1 /*version*/,
+                _version,
                 user.UserName,
                 now,
                 now.Add(ExpirationTimeSpan),
@@ -50,8 +60,8 @@ namespace Orchard.Security.Providers {
             var encryptedTicket = FormsAuthentication.Encrypt(ticket);
 
             var cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket) {
-                HttpOnly = true, 
+                HttpOnly = true, // can't retrieve the cookie from JavaScript
-                Secure = FormsAuthentication.RequireSSL, 
+                Secure = _sslSettingsProvider.GetRequiresSSL(), 
                 Path = FormsAuthentication.FormsCookiePath
             };
 
@@ -108,30 +118,37 @@ namespace Orchard.Security.Providers {
             }
 
             var formsIdentity = (FormsIdentity)httpContext.User.Identity;
+
+            // if the cookie is from a previous format, ignore
+            if (formsIdentity.Ticket.Version != _version) {
+                return null;
+            }
+
             var userData = formsIdentity.Ticket.UserData ?? "";
 
-            // the cookie user data is {userId};{tenant}
+            // the cookie user data is {userName};{tenant}
             var userDataSegments = userData.Split(';');
             
             if (userDataSegments.Length < 2) {
                 return null;
             }
 
-            var userDataId = userDataSegments[0];
+            var userDataName = userDataSegments[0];
             var userDataTenant = userDataSegments[1];
 
+            try {
+                userDataName = userDataName.FromBase64();
+            }
+            catch {
+                return null;
+            }
+
             if (!String.Equals(userDataTenant, _settings.Name, StringComparison.Ordinal)) {
                 return null;
             }
 
-            int userId;
-            if (!int.TryParse(userDataId, out userId)) {
-                Logger.Error("User id not a parsable integer");
-                return null;
-            }
-
             _isAuthenticated = true;
-            return _signedInUser = _contentManager.Get(userId).As<IUser>();
+            return _signedInUser = _membershipService.GetUser(userDataName);
         }
 
         private string GetCookiePath(HttpContextBase httpContext) {

src/Orchard/Utility/Extensions/StringExtensions.cs

@@ -348,5 +348,13 @@ namespace Orchard.Utility.Extensions {
             var pattern = String.Format("{0}", String.Join("|", replacements.Keys));
             return Regex.Replace(original, pattern, match => replacements[match.Value]);
         }
+
+        public static string ToBase64(this string value) {
+            return Convert.ToBase64String(Encoding.UTF8.GetBytes(value));
+        }
+
+        public static string FromBase64(this string value) {
+            return Encoding.UTF8.GetString(Convert.FromBase64String(value));
+        }
     }
 }

src/OrchardBasicCorrectness.ruleset

@@ -1,6 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <RuleSet Name="Orchard Basic Correctness Rules" Description="These rules focus on logic errors and common mistakes made in the usage of framework APIs. Include this rule set to expand on the list of warnings reported by the minimum recommended rules." ToolsVersion="10.0">
-  <Include Path="minimumrecommendedrules.ruleset" Action="Default" />
   <Rules AnalyzerId="Microsoft.Analyzers.ManagedCodeAnalysis" RuleNamespace="Microsoft.Rules.Managed">
     <Rule Id="CA1013" Action="Warning" />
     <Rule Id="CA1033" Action="None" />